Recommending controls: input validation, output encoding, parameterized queries, memory protections, secure coding

Finding a vulnerability is only half of an analyst's job. You also need to recommend a fix that addresses the root cause rather than just the symptom, and the exam will ask you to match each flaw to its best control. Think of layers: the primary fix removes the flaw in the code, and secondary controls such as web application firewalls (WAFs), least privilege and monitoring reduce the damage if something slips through.